Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Two vulnerabilities I reported to baserCMS are now public: CVE-2026-21861 CVE-2026-30940 Thanks to the maintainers for the fix and disclosure. Advisory: https://basercms.net/security/JVN_20837860 #CVE #AppSec #Security
Post summary
Two baserCMS CVEs have been publicly disclosed and patched, with an advisory link provided.
⚡ New CVE Alert: CVE-2026-30940 📊 Severity: 7.2 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-30940 #CVE-2026-30940 #CVE #High #CyberSecurity #InfoSec https://t.co/lQA61IyVnK
Post summary
The tweet announces CVE‑2026‑30940 with minimal details, not indicating PoC, exploit availability, active exploitation, or mitigation advice.
CVE-2026-30940 baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme… https://www.cve.org/CVERecord?id=CVE-2026-30940
Post summary
CVE-2026-30940 is a path traversal vulnerability in baserCMS that affects the theme file management API before version 5.2.3.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30940 - baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE Intel Report: https://ift.tt/eq4Jwrg
Post summary
The post announces a new baserCMS vulnerability (CVE‑2026‑30940) that allows path traversal, arbitrary file write, and RCE, with a link to an intel report but no PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | basercms | basercms | - | - | - |